I'm trying to be able to create different virtual LANs, where, for example, I have 2 groups of pcs A and B belongs to network N1 C and D belongs to network N2 N1 and N2 with his own public IP. For example A: Local ip: 192.168.122.100 B: Local ip: 192.168.122.101 C: Local ip: 192.168.122.102 D: Local ip: 192.168.122.103 Where A and B has the same public ip, and C and D has the same public ip. Now, I want that A can ssh on B, but not on C or D. The same goes for C, where C can access to D via ssh but not to A or B I'm not sure if OVS solve this problem or not, or if this is not possible. Is this possible? How?
Hi, andres.b.dev@gmail.com writes:
I'm trying to be able to create different virtual LANs, where, for example, I have 2 groups of pcs
A and B belongs to network N1 C and D belongs to network N2
N1 and N2 with his own public IP. For example A: Local ip: 192.168.122.100
B: Local ip: 192.168.122.101
C: Local ip: 192.168.122.102
D: Local ip: 192.168.122.103
You've got a few problems here. First, if you have two networks, N1, and N2, you probably DO NOT want the same IP Network (192.168.122) on both N1 and N2. So for your sanity, if A and B are on N1 and C and D are on N2, you might want to use: A: 192.168.10.100 B: 192.168.10.101 C: 192.168.20.100 D: 192.168.20.101
Where A and B has the same public ip, and C and D has the same public ip.
I'm confused by this. What do you mean "has the same public ip"? None of the IPs here are public, they are all RFC1918 (private network) IPs. Do you mean that you've got a router, somewhere, that have a reverse NAT that will translate externally from some public addresses to these private addresses? Also, you will need that reverse NAT to be smart about how it routes. Specifically, once you have an active connection to A or B, it will need to ensure that the connection continues to the same (A or B) target.
Now, I want that A can ssh on B, but not on C or D. The same goes for C, where C can access to D via ssh but not to A or B
I'm not sure I understand what this means. What do you mean by "A can ssh on B"? This is probably a language issue. I think you mean that A and B can ssh to each other but can't reach C or D, and C and D can ssh to each other but can't reach A or B. If you renumber as above then you can do that by not routing between 192.168.10.0/24 and 192.168.20.0/24. However in your original configuration where all four hosts are on the same 192.168.122.0/24 network, there is no way (at the network level) to prevent A and B from talking with C and D.
I'm not sure if OVS solve this problem or not, or if this is not possible.
Is this possible? How?
You can do this with OVS, or even with basic networking, but you will need to create actual separate networks. Good Luck, -derek -- Derek Atkins 617-623-3745 derek@ihtfp.com www.ihtfp.com Computer and Internet Security Consultant
Hi Derek, thanks for the answer.
First, if you have two networks, N1, and N2, you probably DO NOT want the same IP Network (192.168.122) on both N1 and N2. So for your sanity, if A and B are on N1 and C and D are on N2, you might want to use
Sorry, my bad. Yup, masking...
I'm confused by this. What do you mean "has the same public ip"? None of the IPs here are public, they are all RFC1918 (private network) IPs. Do you mean that you've got a router, somewhere, that have a reverse NAT that will translate externally from some public addresses to these private addresses?
Sorry about that. Answering your question, I think yes. I know that 192.X.Y.Z is not public. I mean, I want that as local ip and, for example, 172.X.Y.Z as public ip for the network. Basically, I want to simulate an office, where the owner of the company pays 1 ISP. That isp gives you a router with 1 public ip, and all connected PC (VMs here) has his own local ip. It could be 192.X.Y.Z or 10.X.Y.Z (right? not a network expert as you may notice :P).
I'm not sure I understand what this means. What do you mean by "A can ssh on B"? This is probably a language issue. I think you mean that A and B can ssh to each other but can't reach C or D, and C and D can ssh to each other but can't reach A or B.
Yes, I want that. A <-> B, C <-> D
If you renumber as above then you can do that by not routing between 192.168.10.0/24 and 192.168.20.0/24. However in your original configuration where all four hosts are on the same 192.168.122.0/24 network, there is no way (at the network level) to prevent A and B from talking with C and D.
Yes, I forgot about the network mask.
You can do this with OVS, or even with basic networking, but you will need to create actual separate networks.
What do you mean with creating actual separate networks? Having 1 NIC per public IP? Because I have only 4 NICs and I want to have as many public IPs as possible because I want to have as many virtual offices as possible. Regards.
participants (2)
-
andres.b.dev＠gmail.com -
Derek Atkins